A SOC team wants to automate the sharing of threat intelligence with a partner organization. They use a TIP that supports TAXII. What is the best way to share intelligence securely?

Configure the TIP to push selected IOCs to the partner's TAXII server over TLS

Post the IOCs on a public website

Email the IOCs to the partner as a CSV attachment

Use a shared spreadsheet on a public cloud drive

A threat hunter is using a TIP to investigate a series of alerts. The TIP shows that several indicators are linked to a single campaign. The hunter wants to proactively search for other related indicators that may not yet be in the feed. Which TIP capability is most useful?

Graph-based correlation and pivot analysis

A small manufacturing company has a limited security budget and a two-person SOC team. They need to enrich alerts with indicators of compromise (IOCs) for known malware families but cannot afford a commercial threat intelligence subscription. Which approach best meets their needs?

Use a commercial feed with a free trial and renew only if the budget allows

Subscribe to a free open-source intelligence (OSINT) feed and manually review it weekly

Build an internal feed from their own historical incident data and use it exclusively

Integrate a curated open-source threat intelligence feed into their SIEM with automated IOC matching

A SOC team wants to automate the blocking of malicious IPs from a threat feed, but they are concerned about false positives blocking legitimate customers. They have a TIP and a firewall with an API. What is the best approach to balance automation and safety?

Manually review every IOC before blocking

Automatically block only IOCs with a high confidence score from the TIP, and send lower-confidence IOCs to a review queue

Automatically block all IOCs from the feed without review

Disable the firewall API and use static blocklists

During a threat hunt, an analyst finds a host communicating with a domain that appears in a commercial threat feed as a C2 domain. However, the domain is also used by a legitimate third-party service that the company uses. The feed has a low confidence score for this domain. What should the analyst do?

Ignore the alert because the domain is legitimate

Investigate the host's behavior and network connections before taking action

Remove the domain from the feed to prevent future alerts

Immediately block the domain on the firewall

EC-CouncilSOC Essentials

Domain 7Objective 2

Threat Intelligence Feeds and Platforms SCE Practice Questions (Page 3)

Part of the Threat Intelligence and Hunting domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

5concepts

Questions 11–15

11expert · hard
A SOC team wants to automate the sharing of threat intelligence with a partner organization. They use a TIP that supports TAXII. What is the best way to share intelligence securely?
Select an answer first
12expert · hard
A threat hunter is using a TIP to investigate a series of alerts. The TIP shows that several indicators are linked to a single campaign. The hunter wants to proactively search for other related indicators that may not yet be in the feed. Which TIP capability is most useful?
Select an answer first
13application · medium
A small manufacturing company has a limited security budget and a two-person SOC team. They need to enrich alerts with indicators of compromise (IOCs) for known malware families but cannot afford a commercial threat intelligence subscription. Which approach best meets their needs?
Select an answer first
14expert · hard
A SOC team wants to automate the blocking of malicious IPs from a threat feed, but they are concerned about false positives blocking legitimate customers. They have a TIP and a firewall with an API. What is the best approach to balance automation and safety?
Select an answer first
15expert · hard
During a threat hunt, an analyst finds a host communicating with a domain that appears in a commercial threat feed as a C2 domain. However, the domain is also used by a legitimate third-party service that the company uses. The feed has a low confidence score for this domain. What should the analyst do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.